Oracle 收盘报告

生成包含大盘指数、情绪资金和全球市场数据的A股市场日报，支持节假日处理和飞书卡片格式发送。

Do not install or run this skill without addressing the hardcoded credentials and default recipient. Specifically: - The script contains hardcoded API keys (QVERIS_API_KEY, MX_APIKEY, TUSHARE_TOKEN, FINNHUB_API_KEY). Treat these as compromised: ask the author to remove them or reject the skill. Do not assume they are placeholders. - The script also hardcodes a default FEISHU_TARGET (a specific user id). That means reports (and any data collected) could be sent to an external account without your explicit configuration. - Before using: inspect the full script, remove or replace hardcoded keys with environment-variable reads (and ensure the skill actually honors them), and set FEISHU_TARGET to a value you control. Rotate any API keys that may have been shared in this repo. - Run the script in an isolated/test environment first (no sensitive credentials) and monitor outbound traffic. If you cannot verify the origin/owner or get corrected code, avoid installing or copying this skill to other robots.

Type: OpenClaw Skill Name: oracle-report Version: 1.0.0 The skill bundle is a functional market report generator but contains several high-risk security practices. Most notably, the script 'oracle_report_generator.py' contains multiple hardcoded API keys and tokens for financial services (QVeris, Tushare, Finnhub, and mx_data) as well as a hardcoded Feishu recipient ID. It also frequently uses 'subprocess.run(shell=True)' to execute shell commands and external scripts, which is a significant security risk for shell injection. While the code appears to perform its stated task, the inclusion of hardcoded credentials and the use of unsafe execution methods are characteristic of poorly secured or potentially tracking-enabled software.